---
title: "Setting up RBAC in Weaviate"
description: "Learn how to set up RBAC (Role Based Access Control) in Weaviate"
url: https://docs.weaviate.io/weaviate/tutorials/rbac
---

# Setting up RBAC in Weaviate

**Role-Based Access Control (RBAC)** is a powerful security mechanism that allows you to manage who can access and modify your Weaviate instance. In this tutorial, you'll learn how to set up RBAC in Weaviate by defining roles with tailored permissions and assigning them to users. This enables granular control over operations, from reading and writing data to managing collections and tenants, ensuring that only authorized users can perform specific actions.

In the steps that follow, we’ll cover:

1. **Connecting to Weaviate**\
   Ensure you're authenticated with a user who has the necessary role management permissions.
2. **Creating custom roles**\
   Define roles with specific permissions, such as read, write, tenant management, etc.
3. **Assigning roles to new users**\
   Apply these roles to a new user and limit their access across different resources.

![RBAC Tutorial Diagram](https://docs.weaviate.io/assets/images/rbac-tutorial-diagram-b2da4dd403def88a1d0a72649c265416.png)

By the end of this guide, you’ll have a clear roadmap for implementing RBAC in your Weaviate deployment, adding an essential layer of security to your AI powered applications.

---

We are going to create the following roles:

- **[Read and write permissions](https://docs.weaviate.io/weaviate/tutorials/rbac#read-and-write-permissions):** `rw_role`\
  Learn how to create a custom role that grants read and write access to collections and data, and assign it to a user.
- **[Viewer permissions](https://docs.weaviate.io/weaviate/tutorials/rbac#viewer-permissions):** `viewer_role`\
  Set up a role that restricts users to read-only access for specific collections.
- **[Tenant permissions](https://docs.weaviate.io/weaviate/tutorials/rbac#tenant-permissions):** `tenant_manager`\
  Configure roles with permissions to manage tenants, including creating, reading, and updating tenant information.

## Prerequisites

Before starting this tutorial, ensure you have:

- Docker for running a local Weaviate instance.
- A preferred Weaviate [client library](https://docs.weaviate.io/weaviate/client-libraries) installed.

### Local instance - `root` user

In order to follow the rest of the tutorial we will need to connect to Weaviate with a user who has the `root` role assigned. This will allow us to manage roles and permissions.

Create a Docker Compose file (`docker-compose.yml`) and copy the following configuration:

> [!NOTE]
>
> **The environment variables in this configuration will:**
>
> - Enable RBAC.
> - Configure `root-user` as a user with built-in root/admin permissions.

```yaml
---
services:
  weaviate:
    command:
      - --host
      - 0.0.0.0
      - --port
      - '8080'
      - --scheme
      - http
    image: cr.weaviate.io/semitechnologies/weaviate:1.40.4
    ports:
      - 8080:8080
      - 50051:50051
    volumes:
      - weaviate_data:/var/lib/weaviate
    restart: on-failure:0
    environment:
      QUERY_DEFAULTS_LIMIT: 25
      PERSISTENCE_DATA_PATH: '/var/lib/weaviate'
      CLUSTER_HOSTNAME: 'node1'
      AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED: 'false'
      AUTHORIZATION_ENABLE_RBAC: 'true'
      AUTHORIZATION_RBAC_ROOT_USERS: 'root-user'
      AUTHENTICATION_DB_USERS_ENABLED: 'true'
      AUTHENTICATION_APIKEY_ENABLED: 'true'
      AUTHENTICATION_APIKEY_USERS: 'root-user'
      AUTHENTICATION_APIKEY_ALLOWED_KEYS: 'root-user-key'

volumes:
  weaviate_data:
```

> [!NOTE]
>
> **RBAC specific environment variables**
>
> - `AUTHORIZATION_ENABLE_RBAC`: Enable RBAC to be used.
> - `AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED`: Enable/disable anonymous users from accessing your Weaviate instance.
> - `AUTHENTICATION_DB_USERS_ENABLED`: Enable/disable runtime user management.
> - `AUTHENTICATION_APIKEY_ENABLED`: Enable API key-based authentication.
> - `AUTHENTICATION_APIKEY_USERS`: The API-key based identities that correspond to the `AUTHENTICATION_APIKEY_ENABLED` variable.
> - `AUTHENTICATION_APIKEY_ALLOWED_KEYS`: The allowed API keys, they correspond to a specific user identity.
> - `AUTHORIZATION_RBAC_ROOT_USERS`: Define your root/admin user(s).
>
> More environment variables can be found [here](https://docs.weaviate.io/deploy/configuration/env-vars).

We will connect to Weaviate with `root-user`, and once we create a new role, we will also create a new user `custom-user` and assign the role to it.

## Read and write permissions

### Step 1: Connecting to Weaviate

Ensure you are connected to Weaviate with a user possessing sufficient permissions to manage roles. You can achieve this by either using the predefined `root` role during [Weaviate configuration](https://docs.weaviate.io/deploy/configuration/configuring-rbac) or by granting a user the [`manage_roles` permission](https://docs.weaviate.io/weaviate/configuration/rbac/manage-roles#role-management-permissions).

**Python**

```py
import weaviate
from weaviate.classes.init import Auth

# Connect to Weaviate as root user
client = weaviate.connect_to_local(
    auth_credentials=Auth.api_key("root-user-key"),
)
```

**JavaScript/TypeScript**

```ts
import weaviate, { WeaviateClient } from '@weaviate/node'

// Connect to Weaviate as root user
const client: WeaviateClient = await weaviate.connectToLocal({
    authCredentials: new weaviate.ApiKey("user-a-key")
})
```

**Go (v6)**

```go
// Connect to Weaviate as root user
client, err := weaviate.NewLocal(ctx,
  weaviate.WithAPIKey("root-user-key"),
)
if err != nil {
  // handle error
  panic(err)
}
defer client.Close()
```

### Step 2: Creating a new role with custom permissions

This grants read and write permissions for collections starting with `TargetCollection`, and read permissions to nodes and cluster metadata.

**Python**

```py
from weaviate.classes.rbac import Permissions

# Define permissions (example confers read+write rights to collections starting with "TargetCollection")
permissions = [
    # Collection level permissions
    Permissions.collections(
        collection="TargetCollection*",
        create_collection=True,  # Allow creating new collections
        read_config=True,  # Allow reading collection info/metadata
        update_config=True,  # Allow updating collection configuration, i.e. update schema properties, when inserting data with new properties
        delete_collection=True,  # Allow deleting collections
    ),
    # Collection data level permissions
    Permissions.data(
        collection="TargetCollection*",
        create=True,  # Allow data inserts
        read=True,  # Allow query and fetch operations
        update=True,  # Allow data updates
        delete=False,  # Allow data deletes
    ),
    Permissions.backup(collection="TargetCollection*", manage=True),
    Permissions.Nodes.verbose(collection="TargetCollection*", read=True),
    Permissions.cluster(read=True),
]

# Create a new role
client.roles.create(role_name="rw_role", permissions=permissions)
```

**JavaScript/TypeScript**

```ts
const { permissions } = weaviate

// Define permissions (example confers read+write rights to collections starting with "TargetCollection")
const allPermissions = [
    // Collection level permissions
    permissions.collections({
        collection: "TargetCollection*",
        create_collection:  true,  // Allow creating new collections
        read_config: true,  // Allow reading collection info/metadata
        update_config: true,  // Allow updating collection configuration, i.e. update schema properties, when inserting data with new properties
        delete_collection: true,  // Allow deleting collections
   } ),
    // Collection data level permissions
    permissions.data({
        collection: "TargetCollection*",
        create: true,  // Allow data inserts
        read: true,  // Allow query and fetch operations
        update: true,  // Allow data updates
        delete: false,  // Allow data deletes
    }),
    permissions.backup({
        collection:"TargetCollection*", 
        manage: true
    }),
    permissions.nodes.verbose({
        collection: "TargetCollection*", 
        read: true
    }),
    permissions.cluster({
        read: true
    }),
]

// Create a new role
await client.roles.create("rw_role", allPermissions)
```

**Go (v6)**

```go
// Coming soon
```

### Step 3: Assigning the role to a new user

First, let's create the new user `custom-user`:

**Python**

```py
user_api_key = client.users.db.create(user_id="custom-user")
print(user_api_key)
```

**JavaScript/TypeScript**

```ts
let userApiKey 
userApiKey = await client.users.db.create("custom-user")
console.log(userApiKey)
```

**Go (v6)**

```go
// Create returns the new user's API key. Store it securely; it cannot be
// retrieved again later.
apiKey, err := client.Users.DB.Create(ctx, "custom-user")
if err != nil {
  // handle error
  panic(err)
}
fmt.Printf("new API key: %s\n", apiKey)
```

Now, you can assign the role `rw_role` to `custom-user`:

**Python**

```py
# Assign the role to a user
client.users.db.assign_roles(user_id="custom-user", role_names=["rw_role"])
```

**JavaScript/TypeScript**

```ts
// Assign the role to a user
await client.users.assignRoles(["rw_role"], "user-b",)
```

**Go (v6)**

```go
// Coming soon
```

## Viewer permissions

### Step 1: Connecing to Weaviate

Ensure you are connected to Weaviate with a user possessing sufficient permissions to manage roles. You can achieve this by either using the predefined `root` role during [Weaviate configuration](https://docs.weaviate.io/deploy/configuration/configuring-rbac) or by granting a user the [`manage_roles` permission](https://docs.weaviate.io/weaviate/configuration/rbac/manage-roles#role-management).

**Python**

```py
import weaviate
from weaviate.classes.init import Auth

# Connect to Weaviate as root user
client = weaviate.connect_to_local(
    auth_credentials=Auth.api_key("root-user-key"),
)
```

**JavaScript/TypeScript**

```ts
import weaviate, { WeaviateClient } from '@weaviate/node'

// Connect to Weaviate as root user
const client: WeaviateClient = await weaviate.connectToLocal({
    authCredentials: new weaviate.ApiKey("user-a-key")
})
```

**Go (v6)**

```go
// Connect to Weaviate as root user
client, err := weaviate.NewLocal(ctx,
  weaviate.WithAPIKey("root-user-key"),
)
if err != nil {
  // handle error
  panic(err)
}
defer client.Close()
```

### Step 2: Creating a new role with custom permissions

This grants viewer permissions for collections starting with `TargetCollection`.

**Python**

```py
from weaviate.classes.rbac import Permissions

# Define permissions (example confers viewer rights to collections starting with "TargetCollection")
permissions = [
    Permissions.collections(
        collection="TargetCollection*",
        read_config=True,
    ),
    Permissions.data(collection="TargetCollection*", read=True),
]

# Create a new role
client.roles.create(role_name="viewer_role", permissions=permissions)
```

**JavaScript/TypeScript**

```ts

// Define permissions (example confers viewer rights to collections starting with "TargetCollection")
const newPermissions = [
    permissions.collections({
        collection: "TargetCollection*",
        read_config: true,
    }),
    permissions.data({
        collection: "TargetCollection*", 
        read: true}),
]

// Create a new role
await client.roles.create("viewer_role", newPermissions)
```

**Go (v6)**

```go
// Confer viewer (read-only) rights to collections starting with
// "TargetCollection".
err := client.Roles.Create(ctx, rbac.Role{
  ID: "viewer_role",
  Permissions: rbac.Permissions{
    Collections: []rbac.CollectionPermission{
      {Collection: "TargetCollection*", Read: true},
    },
    Data: []rbac.DataPermission{
      {Collection: "TargetCollection*", Read: true},
    },
  },
})
if err != nil {
  // handle error
  panic(err)
}
```

### Step 3: Assigning the role to a new user

First, let's create the new user `custom-user`:

**Python**

```py
user_api_key = client.users.db.create(user_id="custom-user")
print(user_api_key)
```

**JavaScript/TypeScript**

```ts
let userApiKey 
userApiKey = await client.users.db.create("custom-user")
console.log(userApiKey)
```

**Go (v6)**

```go
// Create returns the new user's API key. Store it securely; it cannot be
// retrieved again later.
apiKey, err := client.Users.DB.Create(ctx, "custom-user")
if err != nil {
  // handle error
  panic(err)
}
fmt.Printf("new API key: %s\n", apiKey)
```

Now, you can assign the role `viewer_role` to `custom-user`:

**Python**

```py
# Assign the role to a user
client.users.db.assign_roles(user_id="custom-user", role_names="viewer_role")
```

**JavaScript/TypeScript**

```ts
// Assign the role to a user
await client.users.assignRoles("user-b", "viewer_role")
```

**Go (v6)**

```go
// Assign the role to a user.
err := client.Users.DB.AssignRoles(ctx, rbac.AssignRolesOptions{
  ID:    "custom-user",
  Roles: []string{"viewer_role"},
})
if err != nil {
  // handle error
  panic(err)
}
```

## Tenant permissions

### Step 1: Connecting to Weaviate

Ensure you are connected to Weaviate with a user possessing sufficient permissions to manage roles. You can achieve this by either using the predefined `root` role during [Weaviate configuration](https://docs.weaviate.io/deploy/configuration/configuring-rbac) or by granting a user the [`manage_roles` permission](https://docs.weaviate.io/weaviate/configuration/rbac/manage-roles#role-management-permissions).

**Python**

```py
import weaviate
from weaviate.classes.init import Auth

# Connect to Weaviate as root user
client = weaviate.connect_to_local(
    auth_credentials=Auth.api_key("root-user-key"),
)
```

**JavaScript/TypeScript**

```ts
import weaviate, { WeaviateClient } from '@weaviate/node'

// Connect to Weaviate as root user
const client: WeaviateClient = await weaviate.connectToLocal({
    authCredentials: new weaviate.ApiKey("user-a-key")
})
```

**Go (v6)**

```go
// Connect to Weaviate as root user
client, err := weaviate.NewLocal(ctx,
  weaviate.WithAPIKey("root-user-key"),
)
if err != nil {
  // handle error
  panic(err)
}
defer client.Close()
```

### Step 2: Creating a new role with custom permissions

This grants permissions to:

- Completely manage tenants starting with `TargetTenant` in collections starting with `TargetCollection`.
- Create, read, update and delete data for tenants starting with `TargetTenant` in collections starting with `TargetCollection`.

**Python**

```py
from weaviate.classes.rbac import Permissions

permissions = [
    Permissions.tenants(
        collection="TargetCollection*",  # Applies to all collections starting with "TargetCollection"
        tenant="TargetTenant*",  # Applies to all tenants starting with "TargetTenant"
        create=True,  # Allow creating new tenants
        read=True,  # Allow reading tenant info/metadata
        update=True,  # Allow updating tenant states
        delete=True,  # Allow deleting tenants
    ),
    Permissions.data(
        collection="TargetCollection*",  # Applies to all collections starting with "TargetCollection"
        tenant="TargetTenant*",  # Applies to all tenants starting with "TargetTenant"
        create=True,  # Allow data inserts
        read=True,  # Allow query and fetch operations
        update=True,  # Allow data updates
        delete=True,  # Allow data deletes
    ),
]

# Create a new role
client.roles.create(role_name="tenant_manager", permissions=permissions)
```

**JavaScript/TypeScript**

```ts
const { permissions } = weaviate

const tenantPermissions = [
    permissions.tenants({
        collection: "TargetCollection*",  // Applies to all collections starting with "TargetCollection"
        tenant: "TargetTenant*",  // Applies to all tenants starting with "TargetTenant"
        create: true,  // Allow creating new tenants
        read: true,  // Allow reading tenant info/metadata
        update: true,  // Allow updating tenant states
        delete: true,  // Allow deleting tenants
    }),
    permissions.data({
        collection: "TargetCollection*",  //  Applies to all collections starting with "TargetCollection"
        tenant: "TargetTenant*",  // Applies to all tenants starting with "TargetTenant"
        create: true,  // Allow data inserts
        read: true,  // Allow query and fetch operations
        update: true,  // Allow data updates
        delete: true,  // Allow data deletes
    })
]

// Create a new role
await client.roles.create("tenant_manager", tenantPermissions)
```

**Go (v6)**

```go
err := client.Roles.Create(ctx, rbac.Role{
  ID: "tenant_manager",
  Permissions: rbac.Permissions{
    Tenants: []rbac.TenantPermission{
      {
        Collection: "TargetCollection*", // Applies to all matching collections.
        Tenant:     "TargetTenant*",     // Applies to all matching tenants.
        Create:     true,                // Allow creating tenants.
        Read:       true,                // Allow reading tenant info.
        Update:     true,                // Allow updating tenant states.
        Delete:     true,                // Allow deleting tenants.
      },
    },
    Data: []rbac.DataPermission{
      {
        Collection: "TargetCollection*", // Applies to all matching collections.
        Tenant:     "TargetTenant*",     // Applies to all matching tenants.
        Create:     true,                // Allow data inserts.
        Read:       true,                // Allow query and fetch operations.
        Update:     true,                // Allow data updates.
        Delete:     true,                // Allow data deletes.
      },
    },
  },
})
if err != nil {
  // handle error
  panic(err)
}
```

### Step 3: Assigning the role to a new user

First, let's create the new user `custom-user`:

**Python**

```py
user_api_key = client.users.db.create(user_id="custom-user")
print(user_api_key)
```

**JavaScript/TypeScript**

```ts
let userApiKey 
userApiKey = await client.users.db.create("custom-user")
console.log(userApiKey)
```

**Go (v6)**

```go
// Create returns the new user's API key. Store it securely; it cannot be
// retrieved again later.
apiKey, err := client.Users.DB.Create(ctx, "custom-user")
if err != nil {
  // handle error
  panic(err)
}
fmt.Printf("new API key: %s\n", apiKey)
```

Now, you can assign the role `tenant_manager` to `custom-user`:

**Python**

```py
# Assign the role to a user
client.users.db.assign_roles(user_id="custom-user", role_names="tenant_manager")
```

**JavaScript/TypeScript**

```ts
// Assign the role to a user
client.users.assignRoles("user-b", "tenant_manager")
```

**Go (v6)**

```go
// Assign the role to a user.
err := client.Users.DB.AssignRoles(ctx, rbac.AssignRolesOptions{
  ID:    "custom-user",
  Roles: []string{"tenant_manager"},
})
if err != nil {
  // handle error
  panic(err)
}
```

## Summary

This tutorial provides a comprehensive guide to configuring RBAC in Weaviate, helping you secure your vector database by managing user access with tailored roles and permissions.

It walks you through connecting to Weaviate using a user with role management capabilities, then demonstrates how to create custom roles for different access levels. You’ll learn how to set up roles with read and write permissions to manage collections and data, configure viewer permissions for read-only access, and establish tenant permissions for managing tenant operations.

## Additional resources

- [RBAC: Configuration](https://docs.weaviate.io/deploy/configuration/configuring-rbac)
- [RBAC: Manage roles](https://docs.weaviate.io/weaviate/configuration/rbac/manage-roles)
- [RBAC: Manage users](https://docs.weaviate.io/weaviate/configuration/rbac/manage-users)